CI: upgrade and fix firebase action; add write permissions

- upgrade the firebase action to the latest release
- pin the node24 version to workaround regression in firebase-tools
- add write permissions needed due to org-level change to read-only default

Signed-off-by: Mike Szczys <michael.szczys@canonical.com>

Author: szczys

.github/workflows/firebase-hosting-merge.yml

@@ -3,6 +3,11 @@
 
 name: Deploy to Firebase Hosting on merge
 
+permissions:
+  deployments: write
+  statuses: write
+  checks: write
+
 on:
   push:
     branches:
@@ -13,17 +18,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: true
+
+      - name: Setup Node
+        # yamllint disable-line rule:line-length
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24.18.0'
 
-      - name: Update and Build
+      - name: Build
         run: |
-          git submodule update --init
           cd website
-          npm install
+          npm ci
           npm run build
 
       - name: Firebase Hosting
-        uses: FirebaseExtended/action-hosting-deploy@v0
+        # yamllint disable-line rule:line-length
+        uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'
           firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_GOLIOTH }}'

.github/workflows/firebase-hosting-pull-request.yml

@@ -3,6 +3,12 @@
 
 name: Deploy to Firebase Hosting on PR
 
+permissions:
+  deployments: write
+  statuses: write
+  checks: write
+  pull-requests: write
+
 on:
   pull_request:
 
@@ -12,17 +18,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: true
+
+      - name: Setup Node
+        # yamllint disable-line rule:line-length
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24.18.0'
 
-      - name: Update and Build
+      - name: Build
         run: |
-          git submodule update --init
           cd website
-          npm install
+          npm ci
           npm run build
 
       - name: Firebase Hosting
-        uses: FirebaseExtended/action-hosting-deploy@v0
+        # yamllint disable-line rule:line-length
+        uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'
           firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_GOLIOTH }}'